use std::fs;
use tonic::transport::{Identity, ServerTlsConfig};
use anyhow::Result;

pub fn load_server_tls_config() -> Result<ServerTlsConfig> {
    // 安装默认的加密提供程序
    rustls::crypto::aws_lc_rs::default_provider()
        .install_default()
        .map_err(|_| anyhow::anyhow!("Failed to install crypto provider"))?;
    
    let cert = fs::read("certs/server-cert.pem")?;
    let key = fs::read("certs/server-key.pem")?;
    let ca_cert = fs::read("certs/ca-cert.pem")?;
    
    let identity = Identity::from_pem(cert, key);
    
    let tls_config = ServerTlsConfig::new()
        .identity(identity)
        .client_ca_root(tonic::transport::Certificate::from_pem(ca_cert));
    
    Ok(tls_config)
}